Women founder funding attribution methods for campaigns: which measurement needs consent under PECR

A women founder funding service may want to know whether email, search or social activity leads to applications. The before-and-after pairs below separate measurements that can be made as aggregate statistics from tracking that follows individuals or supports online advertising. That distinction should be settled before selecting an attribution method.

Begin by examining the device action

Weak version: Treat PECR as a cookie-only rule, then assume measurement sits outside it whenever no cookie is visible.

Regulation 6 of PECR is broader: it covers storing information on, or accessing information already stored in, a visitor's terminal equipment. The technology label alone does not settle whether the rule applies.

Better version: Read the current rule before reviewing tags. Regulation 6(1), subject to Schedule A1, was substituted on 5 February 2026 by the Data (Use and Access) Act 2025. Schedule A1 includes consent and a conditional statistical-purpose route. Check the current legislation at Schedule A1 and the ICO's guidance on exceptions alongside it.

Limit the statistics to their improvement purpose

Weak version: Call any web analytics statistical because it produces a number. That label is not enough.

The exception is limited to information collected solely for statistics about use of a service or website, with a view to making improvements. It is not a route for creating a person-level journey and treating it as anonymous reporting.

Better version: Keep both the purpose and the output narrow. Sharing is allowed only to help make those improvements; visitors must receive notice, have a simple free way to object, and not object. The ICO's examples also require aggregate statistics that cannot identify people. These conditions are the test, not the word analytics.

Sort channel totals from advertising attribution

Weak version: Assume campaign measurement is all one activity and give it one consent answer.

A total of visits from an email source is not the same measurement as a record of what an individual visitor did, or a link between that visitor and an advert interaction. The purpose and level of detail change the assessment.

Better version: Assess each method separately. Source visits and a comparison between page versions may fit the exception if all Schedule A1 conditions are met. Individual action logs, advert views or clicks used for performance measurement, and visitor IDs connected to conversions shared with advertising partners are on the consent side.

Inspect campaign links before choosing a method

Weak version: Assume adding a label to a campaign URL is harmless because it is not a cookie.

Link decoration adds extra information to a URL someone clicks, and online services can use it to identify the source of inbound traffic, such as a particular email campaign. The parameter alone does not settle how the measurement is classified.

Better version: Check what the parameter identifies and what later processing does with it before selecting a method. Follow each flow with attribution UK regulations, then compare the options that remain when cookies are absent with cookieless attribution. Keep the assessment on the collection and use, rather than the tool's label.

Try the decision on one email campaign

Weak version: Say that an email campaign generated applications because its link was tracked. That conclusion may overstate what a source count shows, especially if the setup does not follow an individual founder from the message to the application. Describe the measure at the level it actually records.

Better version: Use an aggregate source label to compare applications without passing an individual visitor ID to an advertising partner. The example can be set out as a short sequence, with the notice and objection route included rather than left outside the measurement description.

This produces a channel-level view, not an account of an individual founder's route through the campaign. The report should state that limitation plainly. If the total differs from another source, it still does not identify which particular founder arrived from which advert or demonstrate that the campaign caused the application.

Match the method to the claim

Weak version: Choose an attribution method first, then describe its output as evidence of campaign impact. Consent-based tracking, aggregate source totals and experiments do not establish the same thing. An aggregate count cannot show an individual path, and it should not be described as proof that a campaign caused applications.

Better version: Pick the route after the tracking decision. Consent-based ad-click and conversion measurement can describe individual paths; aggregate source totals show channel volume; comparisons across periods or regions with and without a campaign estimate whether it added applications. Use incrementality testing vs attribution to explain the distinction and data protection to map each data row to its lawful basis.

Compare the setup before launch

Weak version: Approve a campaign after checking only the headline method. A tag, pixel or decorated link can change what is collected and how it is used. Leaving those details out makes it harder to distinguish aggregate statistics from individual tracking or to spot an advertising-related purpose before measurement starts.

Better version: Make a short inventory and check the relevant references again before launch, since legislation and guidance can change. When checking again, search the regulator's material on cookies and similar technologies, electronic and telephone marketing, lawful basis, right to object, direct marketing guidance, and individual rights, alongside Regulation 6 of PECR and the Data (Use and Access) Act 2025. Review measurement mistakes before publishing results.